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TecT ceTefi m cucTeM Ha yoroCim/iBOCTb ko B3/ioMy (pentest), 1/1/11/1 TecT Ha npoHWKHOBeHMe 


MTO 3TO? 


Tecn/ipoBaHi/ie Ha npoHi/iKHOBeHi/ie (TecTbi Ha 
npeoflo^eHMe 3 aLitnTbi, penetration testing, pentest, 
neHTecT) - bto yc/iyra b ccf)epe nH^opMapi/iOHHOi/i 
6e3onacHOCTM, cyTb KOTopoi/i 3aK/iroHaeTcsi 
b caHKigi/iOHi/ipoBaHHOM nonbiTKe npOHI/IKHyTb 
B l/IH(|)OpMai4HOHHyhO CMCTeMy i/i 0601 /m/i 
cyLu,ecTByioLu,ni7i KOMn/ieKC cpeflCTB ee 3am,MTbi. 

npopecc Tecn/ipoBaHi/isi Ha npoHi/iKHOBeHi/ie 
npe^ycMaipHBaeT MOfle/inpoBaHne pea/ibHbix 
fleMCTBHM 3/lOyMblLLI/ieHHl/IKa, nOl/ICK y?l3Bl/IMOCTeM 
CMCTeMbi 3aiJj,HTbi h i/ix fla/ibHei/iLuyio aKcn/iyaiapHHD. 
Ted Ha npoHMKHOBeHbie no3BO/is3eT no/iyni/iTb 
He3aBi/icnMyro opeHKy hi aiccnepTHoe 3aK/ihOHeHne 
O COCTOSIHI/ll/l 3aL4MLLJ,eHHOCTH KOH^HIfleHlgHia/lbHOM 
HH(f)OpMaLI,|/ll/l. 
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TecT ceTefi m cucTeM Ha ycrotim/iBOCTb ko B3/ioMy (pentest), n/in TecT Ha npoHWKHOBeHMe 


3aneM 3 to HyxHO? 


Pa3pa6oTaHHaa KOMnaHi/ieM «,qe/iOMT» 
MeTOflo/iorMA TecTi/ipoBam/ifl Ha 
npoHUKHOBeHMe noMoxeT BaM H36exaTb 
HHLjUfleHTOB, KOTOpbie MoryT nOflOpBaTb 
penyiapuKD Baujeti opraHi/Bapm/i 
h HaHecTM BaM cymecTBeHHbM yuj,ep6. 

YflaHHaa pea/iM3au,i/ia nonbiTKH 
3Kcn^yaTau,MM o6HapyxeHHbix 
yS33BMMOCTeM l/IC n03B0/lHT 
npofleMOHCTpupoBaTb B03M0XHbie nyTM 
npOHUKHOBeHM^ B MH(()OpMaL(HOHHbie 
CMCTeMbi (l/IC), a TaKxe BbmBHTb c/ia6bie 
MecTa b o6ecneHeHMH HHcfxDpMapHOHHOM 


6e3onacHOCTM. 3 to no3BO/ii/iT OTfle/iHTb 
Kpmi/iHecKi/ie npo6/ieMbi 6e3onacHOCTH, 
Tpe6yK3LLi,Me npHCTa/ibHoro BHMMaHi/a ot 
T ex, KOTOpbie npeflCTaB/iflhOT MeHbLuyho 
yrpo3y. 

A3HaHHT, nOflBI/ITCfl B03M0XH0CTb 
pa3yMHo Bbifle/iaTb cfinHaHcoBbie 
n MaTepi/ia/ibHbie pecypcbi Ha 
o6ecneHeHMe 6e3onacHoc™ l/IC MMeHHO 
na Tex ynacTKax, Ha Korapbix 3to 
Heo6xop,MMO 6anbine Bcero. 


KaK ocyLu,ecTB/ineTcn 


MeTOflo/iori/ifl KOMnaHm/i «f\enoi/\T» 
no npoBefleHMHD TecTi/ipoBaHi/ifl Ha 
npoHi/iKHOBeHi/ie co/],epxi/iT c/ieAyiouji/ie 
3Tanbi: 



n/iaHupoBaHne 
TecTa Ha 
npoHUKHOBeHne 


C6op ny 6 /iMHHO 
AOCTynHbix 
flaHHblX o 
L\e/ieBbix 
cucTeMax 


noi/icK 

y«3BHMOCTei?i l/IC 
(cKaHi/ipoBaHi/ie) 


llpOHUKHOBeHUe 
b cucTeiviy 
(3Kcn/iyaTaM,na 
y«3BHMOCTeM) 


(aTanbi)? 



HanucaHi/ie m 
npe^ocTaB/ieHMe 
OTHeTa 


OnucTKa CMCTeMbi 
OT nOC/ieflCTBMM 
TecTa 
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TecT ceTefi n cncTeM Ha ycT 0 M 4 MB 0 CTb ko B 3 /ioMy (pentest), 1/1/11/1 TecT Ha npoHWKHOBeHMe 


1. n/iaHupoBaHne TecTa Ha 
npoHUKHOBenne 

Ha 3 tom aTane onpefle/iflKrra cpoKH, 
CTOi/iMOdb pa6oT, KOTopbie 6yflyT 
npoBOfli/iTbCfl, MeTOflbi, KOTopbie 6yflyT 
npuMeHeHbi, Ti/m n KO/innecTBO MC 
fljin TecTMpoBaHUfl n (j)opMa OTHeTa. 

CymecTByeT 3 noflxofla k npoBefleHHio 
Tecia Ha npoHHKHOBeHHe: 

White box 

Mcno/iHme/ib HMeeTflocTyn k cucieMaM 
n 06 /iaflaeT no/iHon HHtj^opMaiflnen o hhx. 

Grey box 

McnojiHHTe/ib HMHTHpyeT xaKepoB, 
pacno/iarahoinnx HH^opMapnen 06 MC 
HacTMHHo (HanpMMep, o flnana30He 
IP-aflpecoB, web-caMTax, 4>M3MHecKOM 
pacno/ioxeHnn, MfleHTH(j)nKaTopax 
6 ecnpoBOflHbix ceTen n t. fl.). 

Black box 

Mcno/iHHTe/ib HMHTHpyeT xaKepoB, 
KOTOpbIM H3BeCTHb! TO/lbKO Ha3BaHMe 
KOMnaHi/iM h npaKTMHecKi/i Hy/ieBbie 
CBefleHna o pe/ieBon cncTeMe. 

2 . C6op ny6/iMHHO flocTynHbix 
flaHHbix o 40 /ieBbix ci/iCTeMax 

B obteM pa 6 oT, KaK npaBM.no, BxoflMT 

noncK nH4>opMapnu M3 Taxi/ix 
mctohhmkob: 

• noMCKOBbie cucTeMbi; 

• copna/ibHbie ceTi/i m caMTbi 3H3 komctb; 

• Kaia/iorn npeflnpMflTHM; 

• HOBOCTHbie caMTbi; 

• KopnopaTHBHbie caMTbi KOMnaHHH* 
3aKa3HHKa, can™ KnneHTOB n napTHepoB; 

• caMTbi noncKa paboTbi; 

• 6a3bi flaHHbix WHOIS; 

• DNS-cepBepbi KOMnaHMH; 

• aHa/iM 3 MapiupyTOB ceieBoro 
o 6 opyflOBaHna; 

• aHa/ii /13 e-mail nnceM; 

• 3BOHKI/1 B Call-peHTp KOMnaHMH C IflenbhO 
nO/iyHMTb HH^OpMaiflMIO 0 K/lhOHeBbIX 


coTpyflHHKax KOMnaHMH, o CTpyKType 
KOMnaHMH H TeXHO/lOTHM; 

• ananm MeTanH(j)opMaiJ,nH b flOKyMeHTax, 
pa3Meuj,eHHbix Ha caHTax KOMnaHnn; 

• HenocpeflCTBeHHoe CKaHHpoBaHMe 
CeTM pa3/lHHHblMM HHCTpyMeHTaMM flnn 
BbmB^eHMa IP-aflpecoB, nopTOB, Bepcnn 
c))yHKL(MOHMpyfOLHHX CepBMCOB 

m onepau,MOHHbix chctom. 

Macro yxe Ha btom aiane bo3moxho 
BbWB/ieHHe KpHTHHeCKHX yfl3BHMOCTeH, 
T3KMX KaK 3a6blTbie M/1H «6eCX03Hbie» 
cepBHCbi, He TpebyKDLUMe aBTopM3ai4 HM 
h flaK3LU,Me flOCTyn k BHyTpeHHen ceTM, 
ony6/iMKOBaHHbie KOH(t>nfleHU,nanbHbie 
flaHHbie, naponn h flpyran KpnTHHecKan 
HHtj)opMau,Ma. 

3. riOMCK yfl3BI/IM0CTeft MC 
(CKaHi/ipoBaHi/ie) 

B 3aBHCMMOCTH OT Bbl6paHHblX CMCTeM 
Ha 3TOM 3Tane CKaHMpyhOTCfl yfl3BMMOCTH 
pa3/iHHHbiMM nporpaMMaMH-cKaHepaMH. 
CneL(HaaH3aL(Hfl TaKMx cKaHepoB MoxeT 
6biTb opneHTHpoBaHa Ha TecTMpoBaHMe 
nepMMeipa ceTM, web-canro>B, oTflenbHbix 
nporpaMM m cepBHCOB: 6a3 flaHHbix, VPN- 
yCTpOMCTB, yCTpOMCTB IP-Te/iec))OHMH M T. fl. 

4. npOHMKHOBeHMe B CMCTeiViy 
(BKcrmyaTapi/m yasBUMOCTew) 

HaMfleHHbie noTeHpnanbHbie yn3BMM0CTH 
flo/ixHbi 6biTb npoBepeHbi BpyHHyro, 

HTObbl OT(j)H/lbTpOBaTb BCe /lOXHbie 
cpa6aTbiBaHHfl. 

3tot 3Tan npeflyciviaTpi/iBaeT: 

• BepH(|)MKaL(MK3 M HCC/ieflOBaHMe 
ya3BHMOCTeH; 

• npoBefleHHe aTaK Ha KOMnoHeHTbi MT- 
MHcfjpacTpyKTypbi; 

• noflbop naponen; 

• onpefleneHnecnocoboB 
B3aHMOfleMCTBHH npnnoxeHnn; 

• noflTBepxfleHHe BbmB/ieHHbix 
yn3BHMOCTeH; 

• c6op flOKa3aTe/ibCTB. 


f\m B3J10Ma y^3BMMblX 
MT-CMCTCM HCnOnb3yK3TCfl pa3HblH 
CneL(Ha/IM3MpOBaHHblH HHCTpyMeHTapMH, 
3Kcn/i0HTbi b nyb/iMHHOM flocTyne 
Ha xaKepcKHx canTax. B HeKOTopbix 
cnyHanx noHaflobHTCH co6cTBeHHan 
pa3pa6oTKa BHpycoB m SKcnnonroB flnn 
npOHHKHOBeHHTl BHyTpb CeTH. 

5. HanncaHne 1/1 npeflocTae/ieHMe 
OTHeTa 

Ploc^e npoBefleHHH TecTa na 
npoHHKHOBeHHe pa3pa6aTbiBaeTCfl 
OTHeT O TeCTMpOB3HHH, KOTOpbIM obbIHHO 
coflepxHT: 

• onncaHHe rpaHHip, b paMKax KOTopbix 
6bm npoBefleH TecT Ha npoHHKHOBeHHe; 

• MeTOflbi h cpeflCTBa, KOTopbie 
Mcno/ib30Ba/iHCb bo BpeMfl npoBefleHMsq 
TecTa Ha npoHMKHOBeHMe; 

• onncaHHe BbiHB/ieHHbix flecfjeKTOB 
M HeflOCTaTKOB, B H3CTH0CTM, 
ypOBHfl HX pMCKa H B03M0XH0CTH MX 
MCn0/lb30BaHMH 3/lOyMblLLI/ieHHMKOM; 

• onncaHHe npHMeHeHHbix cpeHapMeB 
npoHMKHOBeHMsa; 

• onncanne flocTMTHyTbix pe3y/ibTaTOB; 

• 6a30ByK) opeHKy phckob 
MHC fjOpMaiflHOHHOH 6e30naCH0CTH 
KoMnaHMn; 

• 6a30ByK) opeHKy npopeccoB 
o6ecneHeHMn MHcfjopMapnoHHOH 
6e3onacHOCTH KoMnaHMn; 

• peKOMeHflapMM no ycTpaHeHHio 
BbmB^eHHblX HeflOCTaTKOB M 
coBepiueHCTBOBaHHHD npoifleccoB 
o6ecneHeHM3 MHcjjopMaiflHOHHOH 
6e3onacHOCTH KoMnaHMn; 

• n/iaH pa6oT no ycTpaHeHnra HanfleHHbix 
yn3BMMOCTen n coBepineHCTBOBaHnho 
npopeccoB o6ecneHeHnsq 
MH(()OpMaL(HOHHOH 6e30naCH0CTH 
KOMnaHMH, npM0pMTe3Hp0BaHHblH 

B COOTBeTCTBHH C KpMTHHHOCTbhO 
yn3BMMOCTen. 


TecT ceTefi m cucTeM Ha ycrotim/iBOCTb ko B3/ioMy (pentest), 1/1/1 1/1 TecT Ha npoHWKHOBeHMe 



Pe3y/ibTaT (mto no/iym/iT 3aKa3m/iK)? 


OcHOBHbiM npenMymecTBOM 
npoBefleHi/m TecTa Ha 
npoHi/iKHOBeHi/ie AB/ifleTCB yci/i/ieHi/ie 
3aLL^i/iii^eHH0CTH l/IC, a i/imghho: 

• BbmB/ieHne MaKci/iMa/ibHoro Ko/ii/mecTBa 
y?i3Bi/iMOCTei/i; 

• npi/iH?iTi/i6 Mep Ha ocHOBe 
o6ocHOBaHHbix peKOMeH^apHM; 


• yBepeHHOCTb B 3aLU,ML4eHHOCTM 
HHC()OpMai4MM; 

• Bbino/iHeHMe Tpe6oBaHMM 
KOHTpo/iMpyKDLU.MX opraHOB/ciaH/^apTOB; 

• 060CH0BaHMe GKD/^XeTOB 
noflpa3Ae/ieHM?i HaycipaHeHMe 
ynyLueHHH. 


npo^o/ixMTe/ibHOCTb npoBe^eHMH TecTa Ha 
npoHMKHOBeHMe BapbnpyeTCH 
b 3 aBnci/iMOCTi/i ot MacnjTa 6 a pa 60 Tbl 
l/l ypOBHH 3 aL 4 MU 4 eHHOCTH oGteKTOB 
TeCTMpOBaHMH. 

MMHMMa/lbHblM cpoK - OT 2 He^e/ib. 
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TecT ceTefi m cucTeM Ha yoroCim/iBOCTb ko B3/ioMy (pentest), 1/1/11/1 TecT Ha npoHWKHOBeHMe 



floMeMy «{\eno\/\T»? 


KoMaHfla «/\enom» - bto cepn/icj)i/iLJ,i / ipoBaHHbie 
cnepi/ia/ii/icTbi b o6/iacTM TecTMpoBaHM?i 
Ha npoHi/iKHOBeHbie (CEH). 


Mbi 06 /iaflaeM 3Ham/iaMH /lymunx npaKTi/iK 
(Cobit), CTaHflapTOB HHCflOpMapi/lOHHOM 
6 e 3 onacHOCTM (ISO/IEC 27001, ISO/ 

IEC 27002, NIST800-1 1 5) m LUi/ipoKHM 
npaKTMMeCKMM OnbITOM BHeflpeHMfl. 

Taxxe Hama KOMaHfla o 6 /ia,qaeT pnflOM 
TeXHl/IK BbmB/ieHMfl yS 33 BMMOCTeM 
pe^eBOM I/1C, npoHMKHOBem/ia b l/IC 6 e 3 
ymep 6 a 6 n 3 Hec-npopeccy KOMnam/in u 
MeTKoro oni/icaHUfl pea/ibHoro cocTOflHi/isq 
3amHLL(eHHOCTM l/IC. 


MeTopi/iKa KOMnaHMM «/He/noi/iT» no 
npoBefleHnro TecTa Ha npoHHKHOBeHMe 
pa3pa6oTaHa Ha ocHOBe 
o6uj,enpM3HaHHbix MexflyHapoflHbix 
MeTOflo/iorni/i (PTES, PCI DSS, ISSAF). 
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deloitte.by 

O «fle/ioMT» 

HaMMeHOBaHMe «fle.noMT» othocmtot k oflHowiy^n6o /iK)6oMy KotiMuecTBy K>pnflMMecKMx /ini4, BicnKwaa mx ac|)(|>M.nMpoBaHHb[e 
mu, a, coBMecTHo bxoablumx b «fle/iotiT Tyiu ToMapy/luMmefl®, HacTHyra KOMnaHuro c oTBeTCTBeHHocrbK) yHacTHMKOB b 
rapaHTMpoBaHHbix mmm npeflenax, 3aperMCTpMpoBaHHyK> b cooTBeTCTBMM c 3aKOHOflaTe/ibCTBOM BenMKo6pMTaHMM (flanee — 
flTTTI). Kaxfloe Taxoe ropMflMMecKoe riMpo nB/ineTcn caMocTonTe/ibHbiM m He3aBMCMMbiM ropMflMHecKMM /iml(om, flTT/1 (Taioxe 
MMeHyeMaa «Mex/iyHapoAHan ceTb «fle.noMT») He npeflocraB.nBeTyc.nyrM K/iMeHTaM HanpnMyio. no,qpo6HaB MHcfiopMaiflMB o 
ropuflMHecKOM crpyKType flTT/1 m BxoflniflMx b Hee ropuflMHecKMx /imp npeflcraB/ieHa Ha cakue www.deloitte.com/about. 

«flenoMT» npeflocraB.nneTyc.nyrM b o 6 aacTM ayflMTa, KOHca/iTMHra, cfiMHaHCOBoro KOHcy/ibTMpoBaHMB, ynpaBtieHMB pMcxaMM, 
Ha/ioroo 6 /ioxeHMB m MHbie ycny™ rocyflapcTBeHHbiM m HacmbiM KOMnaHMBM, pa6oTaK3U4MM b pa3/iMHHbix oTpacnnx 
3K0H0MMKM. «fleaOMT» — MeXflyHapOflHaB ceTb KOMnaHMM, B HMC /10 K/lMeHTOB KOTOpOM BXOflBT 0 K 0/10 HeTbipeXCOT M3 
neTMcoT KpynHeMiuMx KOMnaHMM MMpa no BepcMM xypHana Fortune. «fleaoMT» MMeeT MHoroneTHMM onbiT npammecKOM 
pa 6 oTbi npM o 6 aiyxMBaHMM K/iMeHTOB b /iK> 6 bix crfiepax flenTe/ibHOCTM 60 /iee HeM b 150 CTpaHax Mupa m Mcno/ib3yeT cbom 
o 6 iiinpHbie OTpacneBbie 3HaHMB m onbiT o<a3aHMn BbicoKoicaHecTBeHHbix ycnyr /yin peiueHMa caMbix cnoxHbix 6M3Hec-3aflaH 
K/iMeHTOB. Bonee 244TbicnH cnepMa/iMCTOB «flenoMTa» no BceMy MMpy npMBepxeHbi MflenM flocTMxeHMB pe3y/ibTaT0B, 
KOTopbiMM Mbi MoxeM ropflMTbcn. flnn nonyMeHMB 60 /iee noflpo 6 HoO MHc])opMau,MM 3axoflMTe Ha Hamy crpaHMipy b Facebook, 
Linkedln mbm Twitter. 

FiacToamee coo 6 meHMe coflepxMT MH(j>opMaiflMK> ranbKO o 6 ii(ero xapaxiepa. npM stom hm KOMnaHMB «fleaoMT Tyiu 
ToMapy/lMMMTeA®, hm BxoflniflMe b Hee ropMflMuecKMe nMipa, hm mx atfxfiM/iMpoBaHHbie /iMpa (flanee — «ceTb «flenoMT») He 
npeflCTaBneioT nocpeflCTBOM flaHHoro cooOmeHMn KaKMx-/iM 6 o KOHcyabTapMM mia ycnyr npocfieccMOHanbHoro xapaicrepa, 
ripexfle HeM npMHBTb Ka<oe-nM 6 o peweHMe MnM npeflnpMHBTb <a<Me-aM 6 o fleMCTBMn, Koropbie Moryr 0Tpa3MTbcn Ha BaiueM 
(|)MHaHCOBOM nOnOXeHMM M/ 1 M COCTOBHMM flen, npOKOHCytlbTMpyMTeCb C KBa/lM(])Ml 4 MpOBaHHblM CnepMa/lMCTOM. Hm OflHO M3 
KipMflMHecKMX / 1 M 14 , BxoflBLflMX b ceTb «flenoMT», He HeceT OTBeTCTBeHHOCTM 3 a Ka<Me-nM 6 o y 6 biTKM, noHeceHHbie nro 6 biM 
riMpoM, Mcno/ib3yfOLL(MM HacTonmee coo 6 meHMe. 

© 2017 1/lHocTpaHHoeyHMTapHoe npeflnpMBTMe «flenoMT m Tyni». Bee npaea 3aiHMineHbi. 


